PT-2025-45706 · Maven · Com.Liferay:Com.Liferay.Portal.Security.Ldap.Impl

Published 2025-10-27 · Updated 2025-10-27

OSV

CVSS v4.0

4.6

Medium

Base vector

AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows local users to view user email address in the log files.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

GHSA-CW79-FQ4F-9R96

Affected Products

Com.Liferay:Com.Liferay.Portal.Security.Ldap.Impl

References · 6

• https://osv.dev/vulnerability/GHSA-cw79-fq4f-9r96 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62262 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/fc14297acd87703ba1027d691fa27a6b96bbb57c · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62263 · Note
• https://liferay.atlassian.net/browse/LPE-17826 · Note